{"thread":{"id":"51664","subject":"Updates on centos7 break git access via git-http-backend","startedAt":"2019-08-18T13:53:35Z","lastAt":"2019-08-18T17:01:14Z","messageCount":2,"participants":["Gaeseric Vandal","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"380621","messageId":"009f01d555cc$50564ca0$f102e5e0$@gmail.com","threadId":"51664","inReplyTo":"009e01d555cb$6c8ed640$45ac82c0$@gmail.com","subject":"Updates on centos7 break git access via git-http-backend","fromName":"Gaeseric Vandal","fromEmail":"gaiseric.vandal@gmail.com","sentAt":"2019-08-18T13:53:28Z","receivedAt":"2019-08-18T13:53:35Z","isPatch":false,"sender":{"key":"gaiseric.vandal@gmail.com","avatar":null},"body":"\nThis a is a clarification of an earlier post. I thought gitweb was the problem. \n\n\nThe actual problem appears to be with /usr/libexec/git-core/git-http-backend.\n\nGitweb provides a list to unauthenticated users of available repositories. I don't need that function so I have removed that package to avoid unexpected conflicts.\n\nI recently applied the latest patches on centos7, including git-1.8.3.1-20. When I try to access git repos (either via web browser or git command line.) Repos are configured to require LDAP authentication.\n\nThe httpd ssl-error.log shows\n#\n[Sun Aug 18 09:22:48.113435 2019] [authz_core:debug] [pid 30167] mod_authz_core.c(809): [client x.x.x.x:35876] AH01626: authorization result of : granted [Sun Aug 18 09:22:48.119012 2019] [cgi:error] [pid 30167] [client x.x.x.x:x] AH01215: Request not supported: '/export/gitrepos/ABC [Sun Aug 18 09:22:48.119069 2019] [headers:debug] [pid 30167] mod_headers.c(823): AH01502: headers: ap_headers_output_filter() [Sun Aug 18 09:22:53.124599 2019] [ssl:info] [pid 30167] (70007)The timeout specified has expired: [client x.x.x.x:35876] AH01991: SSL input filter read failed.\n[Sun Aug 18 09:22:53.124723 2019] [ssl:debug] [pid 30167] ssl_engine_io.c(993): [client x.x.x.x:35876] AH02001: Connection closed to child 1 with standard shutdown (#\n\n\nIf I change gitrepos.conf as follows I will get an error about the script not being found - so I know it is being called.\n\n\t#ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/\n\tScriptAlias /git/ /usr/libexec/git-core/git-http-backend_not/\n\n\n\n# git --version\ngit version 1.8.3.1\n\n\n# httpd -v\nServer version: Apache/2.4.6 (CentOS)\nServer built: Jul 29 2019 17:18:49\n#\n\n\nPartial config\n\n # cat /etc/httpd/conf.d/gitrepos.conf\n SetEnv GIT_PROJECT_ROOT /export/gitrepos\n SetEnv GIT_HTTP_EXPORT_ALL\n ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/\n\n RewriteEngine on\n RewriteCond %{QUERY_STRING} service=git-receive-pack [OR]\n RewriteCond %{REQUEST_URI} /git-receive-pack$\n RewriteRule ^/git/ - [E=AUTHREQUIRED]\n\n \n AuthType Basic\n AuthBasicProvider ldap\n AuthLDAPURL \"ldaps://xxxxxxxxxxxxxxx)\"\n AuthLDAPBindDN \"uid=xxxxxxxxxxxx\"\n AuthLDAPBindPassword xxxxxxxxxxxxxxx\n AuthName \"Git Access\"\n Require user xxxxx xxxxx xxxxx\n Order deny,allow\n Deny from env=AUTHREQUIRED\n Satisfy any\n \n\n\n \n AuthType Basic\n AuthBasicProvider ldap\n AuthLDAPURL \"ldaps://xxxxxxxxxxxxxxx)\"\n AuthLDAPBindDN \"uid=xxxxxxxxxxxx\"\n AuthLDAPBindPassword xxxxxxxxxxxxxxx\n AuthName \"Git Access ABC\"\n Require user xxxxx xxxxx xxxxx\n Order deny,allow\n \n\n\nThis had been working fine for several years.\n\nAppreciate any advice\n\nThanks\n\n\n"},{"id":"380623","messageId":"20190818170032.GF365197@genre.crustytoothpaste.net","threadId":"51664","inReplyTo":"009f01d555cc$50564ca0$f102e5e0$@gmail.com","subject":"Re: Updates on centos7 break git access via git-http-backend","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2019-08-18T17:00:49Z","receivedAt":"2019-08-18T17:01:14Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2019-08-18 at 13:53:28, Gaeseric Vandal wrote:\n> \n> This a is a clarification of an earlier post. I thought gitweb was the problem.\n> \n> \n> The actual problem appears to be with /usr/libexec/git-core/git-http-backend.\n> \n> Gitweb provides a list to unauthenticated users of available repositories. I don't need that function so I have removed that package to avoid unexpected conflicts.\n> \n> I recently applied the latest patches on centos7, including git-1.8.3.1-20. When I try to access git repos (either via web browser or git command line.) Repos are configured to require LDAP authentication.\n>\n> The httpd ssl-error.log shows\n> #\n> [Sun Aug 18 09:22:48.113435 2019] [authz_core:debug] [pid 30167] mod_authz_core.c(809): [client x.x.x.x:35876] AH01626: authorization result of : granted [Sun Aug 18 09:22:48.119012 2019] [cgi:error] [pid 30167] [client x.x.x.x:x] AH01215: Request not supported: '/export/gitrepos/ABC [Sun Aug 18 09:22:48.119069 2019] [headers:debug] [pid 30167] mod_headers.c(823): AH01502: headers: ap_headers_output_filter() [Sun Aug 18 09:22:53.124599 2019] [ssl:info] [pid 30167] (70007)The timeout specified has expired: [client x.x.x.x:35876] AH01991: SSL input filter read failed.\n> [Sun Aug 18 09:22:53.124723 2019] [ssl:debug] [pid 30167] ssl_engine_io.c(993): [client x.x.x.x:35876] AH02001: Connection closed to child 1 with standard shutdown (#\n> \n\nIf this only breaks on upgrade from an older version of Git on CentOS,\nI'd file a bug with the CentOS (or Red Hat) folks. I expect that this\nis due to a patch that Red Hat applied, and not really a limitation in\nGit.\n\nAs you might be aware, Git 1.8.3.1 is rather old; we've just released\n2.23.0. You could try using a version of Git from Software Collections\n(2.18 is available) and see if that works better for you, but I suspect\nmost folks on the list don't pay much attention to versions before 2.0.\n\nBe aware that it may be Apache that's the problem here and not Git if it\nwas also upgraded.\n-- \nbrian m. carlson: Houston, Texas, US\nOpenPGP: https://keybase.io/bk2204\n"}]}